DNS Anomaly Detection via Segmented Queues and Source Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for analyzing DNS query data are not fully secure and struggle to handle large volumes of data, leading to potential system crashes and missed security vulnerabilities in network activity detection.
Innovation Solution
A method and system for detecting anomalies in network activity using DNS query data, which involves receiving, parsing, and routing DNS query data to queues for processing, authenticating data sources, and storing data in a time-series database to detect characteristics and geolocation of DNS queries, ensuring secure and efficient data collection and analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current systems analyze DNS query data, then security vulnerabilities can be detected, but the systems are not fully secure and may crash under large data volumes
Solution Approach 1:
The system divides DNS query data into multiple queues (first queue for DNS query data, second queue for network domain data) to segment the data processing workload. This segmentation allows the system to handle large volumes of data without crashing by processing data in manageable chunks through multiple concurrent processing threads.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that verifies data sources before processing. This intermediary layer prevents forged data and unauthorized sources from entering the processing pipeline, enhancing system security without compromising data volume handling capabilities.
2Reliability
If DNS query data is collected and analyzed, then security vulnerabilities can be detected, but forged data and unauthorized sources may compromise the system
Solution Approach 1:
The system performs preliminary authentication of data sources before processing DNS query data. By verifying the authenticity of data sources in advance, the system prevents forged data from compromising detection accuracy or entering the processing pipeline.
Solution Approach 2:
An intermediary authentication mechanism is introduced between data sources and the processing system. This intermediary layer validates data sources and filters out unauthorized or forged data, ensuring that only legitimate data is processed for security vulnerability detection.
3Productivity
If the system processes large volumes of DNS query data, then comprehensive security analysis is achieved, but system crashes and data loss occur
Solution Approach 1:
The system segments DNS query data into multiple queues and uses multiple processing threads to handle data volumes. This segmentation enables the system to process large amounts of data concurrently without overwhelming any single processing unit, preventing crashes and ensuring continuous operation.
Solution Approach 2:
The patent implements continuous data collection and processing through multiple queues and concurrent processing threads. The system maintains continuous operation by constantly processing data from all queues without interruption, ensuring no data is lost even under high volume conditions.
Data Source
AI summary
Provided are systems for detecting an anomaly in network activity using Domain Name System (DNS) query data that include a processor to receive data associated with a plurality of DNS queries from a plurality of data sources, parse the data associated with the plurality of DNS queries to provide DNS query data and network domain data, route the DNS query data to a first queue using a queries exchange, route the network domain data to a second queue using a domains exchange, poll the first queue and the second queue with a microservice application to receive the DNS query data and the network domain data with the microservice application for processing, and detect a characteristic of the one or more DNS queries of the plurality of DNS queries based on the DNS query data and the network domain data. Methods and computer program products are also disclosed.